CVE-2026-54707 OnionShare Receive mode writes uploaded files even when file uploads are disabled
Attackers can upload files to OnionShare Receive mode even when file uploads are disabled, bypassing security restrictions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54707?
CVE-2026-54707 is a medium-severity missing authorization vulnerability in onionshare, published on 31 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop does not enforce the Receive mode disable_files setting in cli/onionshare_cli/web/receive_mode.py, where ReceiveModeRequest._get_file_stream() writes multipart file[] data to disk despite the text-only setting. This issue is fixed in version 2.6.4.
Weakness: CWE-863
Which versions are affected by CVE-2026-54707?
3 open source packages ship an affected version, including onionshare-cli.
| Package | Affected | Fixed in |
|---|---|---|
onionshare-cli PyPI | All versions | 2.6.4 |
onionshare-cli PyPI | All versions | 2.6.4 |
onionshare-cli PyPI | All versions | 2.6.4 |
How do I fix CVE-2026-54707?
Upgrade onionshare-cli to 2.6.4 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-54707 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54707 exists.
Sources
Also known as DEBIAN-CVE-2026-54707, GHSA-v833-3823-cmhp, PYSEC-2026-3586, UBUNTU-CVE-2026-54707.